Do not overstate the guarantee
A personal-device routing tool may control destinations without isolating every request from an app. A single-node group and on-demand reconnection do not establish fail-closed behavior after the network extension exits.
Managed VPN and per-app capabilities depend on OS version and management model. Confirm the actual supported scope without installing a management profile or replacing another VPN merely because a guide mentions one.
Protocols, resources and safe testing
Inspect DNS, IPv6, UDP failure behavior, excluded routes and resource precedence in both configuration and app preferences. Blocking UDP fallback does not rule out TCP relays or system delegates. Keep TLS validation.
Record Wi-Fi, cellular, switching, sleep/wake and resource refresh separately. Without an independent safe boundary, tunnel-loss tests remain untested. Do not disable production protection to demonstrate leakage.